actions_poc/.github/workflows/custom-runner-gcp.yml at main · kuisathaverat/actions_poc · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
# This workflow shows how to launch a custom runner in GitHub Actionsand use it
name: Custom runner

permissions:
  contents: read
  id-token: write

env:
  WORKLOAD_IDENTITY_PROVIDER: 'projects/844024446343/locations/global/workloadIdentityPools/github-action-identity-pool/providers/github-actions-oidc-token'
  SERVICE_ACCOUNT: 'github-actions-vms@github-actions-356108.iam.gserviceaccount.com'
  GCP_ZONE: us-central1-a

on:
  workflow_dispatch:

jobs:
  provision:
    runs-on: ubuntu-latest
    outputs:
      label: ${{ steps.set-label.outputs.label }}
    steps:
      - uses: actions/checkout@v3
      - id: 'auth'
        name: 'Authenticate to GCP'
        uses: 'google-github-actions/auth@v0.8.0'
        with:
            create_credentials_file: 'true'
            workload_identity_provider: ${{ env.WORKLOAD_IDENTITY_PROVIDER }}
            service_account: ${{ env.SERVICE_ACCOUNT }}
      - name: Set INSTANCE env var
        run: echo "INSTANCE=github-action-runner-${GITHUB_SHA}" >> $GITHUB_ENV
      - name: Get Token
        run: |
          TOKEN=$(curl -sS \
              -X POST \
              -H "Accept: application/vnd.github+json" \
              -H "Authorization: token ${{ secrets.PAT }}" \
              https://api.github.com/repos/${{ github.repository }}/actions/runners/registration-token |jq -r .token)
          echo "TOKEN=${TOKEN}" >> $GITHUB_ENV
          echo "::add-mask::${TOKEN}"
      - name: 'Provision Runner'
        run: |-
          set -e
          gcloud compute instances create ${{ env.INSTANCE }} \
            --tags="githubactions,ci,ephemeral,linux" \
            --project=${{ env.CLOUDSDK_PROJECT }} \
            --zone=${{ env.GCP_ZONE }} \
            --machine-type=e2-micro \
            --network-interface=network-tier=PREMIUM,subnet=default \
            --maintenance-policy=MIGRATE

          cat > runner.sh <<EOF
          mkdir actions-runner && cd actions-runner
          curl -o actions-runner-linux-x64-2.294.0.tar.gz \
            -L https://github.com/actions/runner/releases/download/v2.294.0/actions-runner-linux-x64-2.294.0.tar.gz
          echo "a19a09f4eda5716e5d48ba86b6b78fc014880c5619b9dba4a059eaf65e131780  actions-runner-linux-x64-2.294.0.tar.gz" | sha256sum -c
          tar xzf ./actions-runner-linux-x64-2.294.0.tar.gz
          sudo ./bin/installdependencies.sh
          ./config.sh --url https://github.com/kuisathaverat/actions_poc \
            --token ${TOKEN} --ephemeral \
            --labels "self-hosted,Linux,X64,${INSTANCE}" \
            --url https://github.com/kuisathaverat/actions_poc \
            --unattended \
            --disableupdate
          ls -la
          pwd
          sudo ./svc.sh install $USER
          sudo ./svc.sh start
          EOF

          gcloud compute ssh ${INSTANCE} --command "$(cat runner.sh)" --zone=${{ env.GCP_ZONE }} --project=${{ env.CLOUDSDK_PROJECT }}
      - id: set-label
        run: echo "::set-output name=label::${INSTANCE}"

  build:
    needs: provision
    runs-on: ${{ needs.provision.outputs.label }}
    steps:
      - run: echo uname -a

  deprovision:
    runs-on: ubuntu-latest
    needs: build
    if: ${{ always() }}
    steps:
      - uses: actions/checkout@v3
      - id: 'auth'
        name: 'Authenticate to GCP'
        uses: 'google-github-actions/auth@v0.8.0'
        with:
            create_credentials_file: 'true'
            workload_identity_provider: ${{ env.WORKLOAD_IDENTITY_PROVIDER }}
            service_account: ${{ env.SERVICE_ACCOUNT }}
      - name: Set INSTANCE env var
        run: echo "INSTANCE=github-action-runner-${GITHUB_SHA}" >> $GITHUB_ENV
      - name: Get Token
        run: |
          TOKEN=$(curl -sS \
              -X POST \
              -H "Accept: application/vnd.github+json" \
              -H "Authorization: token ${{ secrets.PAT }}" \
              https://api.github.com/repos/${{ github.repository }}/actions/runners/registration-token |jq -r .token)
          echo "TOKEN=${TOKEN}" >> $GITHUB_ENV
          echo "::add-mask::${TOKEN}"
      - name: 'Deprovision Runner'
        run: |-
          cat > uninstall.sh <<EOF
          cd /home/runner/actions-runner
          sudo ./svc.sh stop
          sudo ./svc.sh uninstall $USER
          ./config.sh remove --token ${TOKEN}
          EOF
          gcloud compute ssh ${INSTANCE} --command "$(cat uninstall.sh)" --zone=${{ env.GCP_ZONE }} --project=${{ env.CLOUDSDK_PROJECT }}
          gcloud compute instances delete ${{ env.INSTANCE }} --zone=${{ env.GCP_ZONE }} --project=${{ env.CLOUDSDK_PROJECT }}